A critical sandbox escape vulnerability has been disclosed in vm2, a popular Node.js library used to run untrusted code in a sandboxed environment. CVE-2026-22709 allows attackers to bypass Promise ...